GHSA-p9jg-9w87-6rg4
TYPO3 Improper Access Management in the File Abstraction Layer
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | typo3/cms-core | >= 6.0, < 6.0.9 | 6.0.9 |
| Packagist | typo3/cms-core | >= 6.1, < 6.1.4 | 6.1.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.
References
External links from the advisory. They lead to third-party sites.